{"id":"CVE-2022-42475","aliases":["EUVD-2022-45545","GHSA-p3vq-4cxh-gfp9"],"status":"published","title":"A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0...","description":"A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier  and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.","severity":{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.99474,"percentile":0.99943,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-197","CWE-787"],"published":"2023-01-02T08:18:49Z","modified":"2026-06-17T05:04:59Z","kev":{"date_added":"2022-12-13","due_date":"2023-01-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-12-13"},{"source":"kev","since":"2022-12-13"}],"exploits":[{"source":"pocgithub","id":"bryanster/ioc-cve-2022-42475","title":"bryanster/ioc-cve-2022-42475","date":"2023-01-17","url":"https://github.com/bryanster/ioc-cve-2022-42475"},{"source":"pocgithub","id":"scrt/cve-2022-42475","title":"scrt/cve-2022-42475","date":"2023-02-23","url":"https://github.com/scrt/cve-2022-42475"},{"source":"pocgithub","id":"Amir-hy/cve-2022-42475","title":"Amir-hy/cve-2022-42475","date":"2023-03-16","url":"https://github.com/Amir-hy/cve-2022-42475"},{"source":"pocgithub","id":"Mustafa1986/cve-2022-42475-Fortinet","title":"Mustafa1986/cve-2022-42475-Fortinet","date":"2023-03-22","url":"https://github.com/Mustafa1986/cve-2022-42475-Fortinet"},{"source":"pocgithub","id":"P4x1s/CVE-2022-42475-RCE-POC","title":"P4x1s/CVE-2022-42475-RCE-POC","date":"2023-03-23","url":"https://github.com/P4x1s/CVE-2022-42475-RCE-POC"},{"source":"pocgithub","id":"natceil/cve-2022-42475","title":"natceil/cve-2022-42475","date":"2023-04-27","url":"https://github.com/natceil/cve-2022-42475"},{"source":"pocgithub","id":"0xhaggis/CVE-2022-42475","title":"0xhaggis/CVE-2022-42475","date":"2023-06-21","url":"https://github.com/0xhaggis/CVE-2022-42475"},{"source":"pocgithub","id":"ArthurHendrich/CVE-2022-42475-POC","title":"ArthurHendrich/CVE-2022-42475-POC","date":"2026-02-27","url":"https://github.com/ArthurHendrich/CVE-2022-42475-POC"},{"source":"pocgithub","id":"uLl0a/cve-2022-42475-poc","title":"uLl0a/cve-2022-42475-poc","date":"2026-08-25","url":"https://github.com/uLl0a/cve-2022-42475-poc"}],"products":[{"vendor":"fortinet","product":"fortios"},{"vendor":"fortinet","product":"fortiproxy"}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-398","tags":["x_transferred","Exploit","Mitigation","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42475","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42475"},{"url":"https://github.com/advisories/GHSA-p3vq-4cxh-gfp9"}],"sources":{"cve":[{"id":"CVE-2022-42475","description":"A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier  and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.","status":"published","published":"2023-01-02T08:18:49.444Z","modified":"2025-10-21T23:15:29.105Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C","level":"critical","assessor":"cna"}],"cwes":["CWE-197"],"updated_at":"2026-11-02T14:34:27.640972Z"}],"euvd":[{"id":"EUVD-2022-45545","description":"A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier  and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.","status":"published","published":"2023-01-02T08:18:49Z","modified":"2025-10-21T23:15:29Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C","level":"critical"}],"exploited_since":"2022-12-13","updated_at":"2026-11-02T20:31:26.48918Z"}],"ghsa":[{"id":"GHSA-p3vq-4cxh-gfp9","title":"A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0...","description":"A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.","status":"published","published":"2023-01-02T09:31:57Z","modified":"2025-10-22T00:32:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-197","CWE-787"],"updated_at":"2026-11-02T15:04:05.954742Z"}],"kev":[{"id":"CVE-2022-42475","title":"Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability","description":"Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.","cwes":["CWE-197"],"kev":{"date_added":"2022-12-13","due_date":"2023-01-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2022-42475","description":"A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier  and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.","status":"published","published":"2023-01-02T09:15:09.49Z","modified":"2026-06-17T05:04:59.63Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-197","CWE-787"],"updated_at":"2026-11-02T14:07:34.758863Z"}]}}